| Gói / sản phẩm | Phiên bản bị ảnh hưởng | Phiên bản đã vá |
|---|---|---|
| october/october | ≥ 1.0.319, < 1.0.466 | 1.0.466 |
| october/system | ≥ 1.0.319, < 1.0.466 | 1.0.466 |
Passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code.
Issue has been patched in Build 466 (v1.0.466) by applying the recommended patch from @jquery.
Apply https://github.com/octobercms/october/commit/5c7ba9fbe9f2b596b2f0e3436ee06b91b97e5892 to your installation manually if unable to upgrade to Build 466.
If you have any questions or comments about this advisory:
Assessed as Moderate by the @jquery team.
Thanks to @mrgswift for reporting the issue to the October CMS team.
Bạn đang dùng một trong các sản phẩm này? Quét site để biết có đang lộ phiên bản có lỗ hổng không.
Quét site miễn phí